It's not enough to just validate the tests: you would also want a tamper-proof record of exactly what source code was actually built. Probably also the full env

It's not enough to just validate the tests: you would also want a tamper-proof record of exactly what source code was actually built. Probably also the full environment. 99.99% of the time this will be irrelevant trivia, but that one time you need to know, there's no substitute.